Fix a memory corruption problem in software M4v/H263 decoder due to out-of-scope local variable
diff --git a/media/libstagefright/OMXCodec.cpp b/media/libstagefright/OMXCodec.cpp
index 8d728ce..d8bd25d 100644
--- a/media/libstagefright/OMXCodec.cpp
+++ b/media/libstagefright/OMXCodec.cpp
@@ -123,11 +123,11 @@
{ MEDIA_MIMETYPE_AUDIO_AAC, "OMX.PV.aacdec" },
{ MEDIA_MIMETYPE_VIDEO_MPEG4, "OMX.qcom.video.decoder.mpeg4" },
{ MEDIA_MIMETYPE_VIDEO_MPEG4, "OMX.TI.Video.Decoder" },
- OPTIONAL(MEDIA_MIMETYPE_VIDEO_MPEG4, "M4vH264Decoder")
+ OPTIONAL(MEDIA_MIMETYPE_VIDEO_MPEG4, "M4vH263Decoder")
{ MEDIA_MIMETYPE_VIDEO_MPEG4, "OMX.PV.mpeg4dec" },
{ MEDIA_MIMETYPE_VIDEO_H263, "OMX.qcom.video.decoder.h263" },
{ MEDIA_MIMETYPE_VIDEO_H263, "OMX.TI.Video.Decoder" },
- OPTIONAL(MEDIA_MIMETYPE_VIDEO_H263, "M4vH264Decoder")
+ OPTIONAL(MEDIA_MIMETYPE_VIDEO_H263, "M4vH263Decoder")
{ MEDIA_MIMETYPE_VIDEO_H263, "OMX.PV.h263dec" },
{ MEDIA_MIMETYPE_VIDEO_AVC, "OMX.qcom.video.decoder.avc" },
{ MEDIA_MIMETYPE_VIDEO_AVC, "OMX.TI.Video.Decoder" },
diff --git a/media/libstagefright/codecs/m4v_h263/dec/M4vH263Decoder.cpp b/media/libstagefright/codecs/m4v_h263/dec/M4vH263Decoder.cpp
index efd8390..10687e0 100644
--- a/media/libstagefright/codecs/m4v_h263/dec/M4vH263Decoder.cpp
+++ b/media/libstagefright/codecs/m4v_h263/dec/M4vH263Decoder.cpp
@@ -13,8 +13,9 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-#define LOG_NDEBUG 0
+//#define LOG_NDEBUG 0
#define LOG_TAG "M4vH263Decoder"
+#include <utils/Log.h>
#include "ESDS.h"
#include "M4vH263Decoder.h"
@@ -37,8 +38,9 @@
mHandle(new tagvideoDecControls),
mInputBuffer(NULL),
mNumSamplesOutput(0) {
- memset(mHandle, 0, sizeof(tagvideoDecControls));
+ LOGV("M4vH263Decoder");
+ memset(mHandle, 0, sizeof(tagvideoDecControls));
mFormat = new MetaData;
mFormat->setCString(kKeyMIMEType, MEDIA_MIMETYPE_VIDEO_RAW);
CHECK(mSource->getFormat()->findInt32(kKeyWidth, &mWidth));
@@ -47,7 +49,6 @@
mFormat->setInt32(kKeyHeight, mHeight);
mFormat->setInt32(kKeyColorFormat, OMX_COLOR_FormatYUV420Planar);
mFormat->setCString(kKeyDecoderComponent, "M4vH263Decoder");
-
}
M4vH263Decoder::~M4vH263Decoder() {
@@ -76,7 +77,7 @@
uint32_t type;
const void *data = NULL;
size_t size = 0;
- uint8_t *vol_data = NULL;
+ uint8_t *vol_data[1] = {0};
int32_t vol_size = 0;
if (mSource->getFormat()->findData(kKeyESDS, &type, &data, &size)) {
ESDS esds((const uint8_t *)data, size);
@@ -86,14 +87,17 @@
size_t codec_specific_data_size;
esds.getCodecSpecificInfo(&codec_specific_data, &codec_specific_data_size);
- vol_data = (uint8_t *) codec_specific_data;
+ vol_data[0] = (uint8_t *) malloc(codec_specific_data_size);
+ memcpy(vol_data[0], codec_specific_data, codec_specific_data_size);
vol_size = codec_specific_data_size;
} else {
- vol_data = NULL;
+ vol_data[0] = NULL;
vol_size = 0;
+
}
CHECK_EQ(PV_TRUE, PVInitVideoDecoder(
- mHandle, &vol_data, &vol_size, 1, mWidth, mHeight, mode));
+ mHandle, vol_data, &vol_size, 1, mWidth, mHeight, mode));
+ if (vol_data[0]) free(vol_data[0]);
MP4DecodingMode actualMode = PVGetDecBitstreamMode(mHandle);
CHECK_EQ(mode, actualMode);
diff --git a/media/libstagefright/include/M4vH263Decoder.h b/media/libstagefright/include/M4vH263Decoder.h
index d4e4e3a..880ec7c 100644
--- a/media/libstagefright/include/M4vH263Decoder.h
+++ b/media/libstagefright/include/M4vH263Decoder.h
@@ -45,7 +45,6 @@
private:
sp<MediaSource> mSource;
bool mStarted;
- bool mInitialized;
int32_t mWidth, mHeight;
sp<MetaData> mFormat;